# Search when using chef\_vault\_secret

**URL:** <https://discourse.chef.io/t/search-when-using-chef-vault-secret/11088>\
**Category:** Chef Infra (archive)\
**Created:** [June 27, 2017, 5:32pm UTC](https://discourse.chef.io/t/search-when-using-chef-vault-secret/11088 "2017-06-27T17:32:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![elbarn](https://avatars.discourse-cdn.com/v4/letter/e/b9bd4f/32.png) [@elbarn](https://discourse.chef.io/u/elbarn)\
**Post date:** [June 27, 2017, 5:32pm UTC](https://discourse.chef.io/t/search-when-using-chef-vault-secret/11088/1 "2017-06-27T17:32:52Z")

</div>

In a [blog post about Chef Vault](https://blog.chef.io/2016/01/21/chef-vault-what-is-it-and-what-can-it-do-for-you/), Nell edited the article with the following:

> NOTE: After posting this, I received feedback that searching for nodes using the -S tag can be insecure. This is because any node which has been compromised can potentially fake its own data and be picked up by the search. If this happens, the next time someone runs knife vault refresh, the compromised node could be illicitly given decryption access.

The secrets I'm planning on storing are going to be unique per node so operating with the least-privilege mindset, nodeA should generate a secret that can only be accessed by AdminUser and nodeA and nodeB should generate a secret that can only be accessed by AdminUser and nodeB.

To that end, I'm trying to figure out how to accomplish securing against a compromised node being included on a search. In the recipe, I have code like this:

`chef_vault_secret "set-secret" do id "#{node['hostname']}-secret" data_bag vault_name admins vault_admins # search "name:#{node.name}" raw_data('key' => value) action :create end`

When using `chef_vault_secret` without a `search` specified, the Chef server interprets the search to be `*:*`  
 ![](https://sea2.discourse-cdn.com/flex016/images/transparent.png).

When I go to the Chef server, manually edit the JSON and delete the search\_query field (or set it to `[]` which sets it to `null`), I get this error:  
`ERROR: knife encountered an unexpected error This may be a bug in the 'vault refresh' knife command or plugin Please collect the output of this command with the `-VV` option before filing a bug report. Exception: NameError: undefined local variable or method 'vault' for #<ChefVault::Item:0x007fa8ffa87960>`

Setting the search\_query to `':'` is invalid, and I can't think of anything else that would negate the search.

I'm not sure what the blog post would be suggesting to do to not search. Any ideas?